In England, the NHS Records Management Code sets a minimum of 25 years for maternity records, and 30 years from diagnosis for cancer records. In Germany, the law sets a ten-year minimum after treatment ends. Health data is some of the longest-lived confidential data any organization holds. That is exactly what makes it a target for an attack that has not happened yet.
Store now, decrypt later
Today's public-key cryptography, RSA and elliptic curves, protects almost every encrypted connection and every digital signature a hospital relies on. A large enough quantum computer would break it. Nobody has built one. But an attacker does not need one today. They can copy encrypted traffic and backups now and wait. NIST's draft transition guidance (IR 8547) describes the threat simply: adversaries "collect encrypted data now with the goal of decrypting it once quantum technology matures." It names medical records as an example of data with long-term sensitivity.
How long is the wait? Estimates have been falling. In May 2025, Google's Craig Gidney estimated that RSA-2048 could be factored in less than a week with fewer than a million noisy qubits, down from the 20 million in a 2019 estimate he co-authored with Martin Ekerå. The Global Risk Institute's expert survey rates a cryptographically relevant quantum computer "quite possible" (28 to 49%) within ten years and "likely" (51 to 70%) within fifteen. Nobody knows the date. For a record that must stay confidential for 25 years, nobody needs to.
Hospitals are in the 2030 bucket
In June 2025, EU member states agreed a coordinated roadmap for the move to post-quantum cryptography (PQC). It sets three dates:
By the end of 2026, every member state should have taken the first steps and set out an initial national transition roadmap.
By the end of 2030, high-risk use cases should be migrated.
By 2035, as many systems as feasible.
Its definition of high risk is the one that matters for healthcare: if confidentiality must be protected "for a long time period (at least 10 years)", and a later breach would still do significant harm, the quantum risk is high. By that test, a hospital's patient records belong in the 2030 group, not the 2035 one.
The UK's NCSC sets a similar path: discovery by 2028, priority migration by 2031, everything by 2035. France's ANSSI goes further on procurement, saying in its PQC FAQ that it will not be reasonable to buy products without PQC after 2030.
Encryption and authentication are different problems
This distinction saves effort. Stored encrypted data is exposed retroactively: what is captured today can be read later. Authentication is not. NIST's draft transition report puts it this way: an authentication system "remains secure as long as the cryptographic algorithms and keys used to perform the authentication are secure when the authentication is performed." Yesterday's sign-in cannot be replayed by tomorrow's quantum computer.
So the urgent work is confidentiality: TLS to and from clinical systems, VPNs, encrypted backups, data shared with other providers. The web is already well along; Cloudflare reported in June 2026 that over two-thirds of browser traffic to its network is protected with post-quantum encryption. Clinical systems lag. A Forescout study published in October 2026 found that only 31% of more than 5,500 internet-exposed healthcare systems supported TLS 1.3, the version that hybrid post-quantum key exchange for TLS (RFC 10024, August 2026) requires.
Authentication has a longer runway, with two exceptions. Root certificates, firmware signing keys and signed records that must stay verifiable for decades are long-lived, so they behave more like encrypted archives. And PKI takes years to replace. The NCSC warns that a system "will not provide quantum-secure authentication until migration of your PKI is complete."
The hardware question
The new standards, FIPS 203, 204 and 205, were finalised in August 2024. Their keys and signatures are much larger. An ML-DSA-44 signature is 2,420 bytes; an ECDSA P-256 signature is about 64 to 72. That matters for smart cards, security keys and medical devices with little memory and slow links. The plumbing is arriving: IETF has published RFCs for ML-DSA in X.509 certificates and in COSE, the key format WebAuthn uses, and NIST published working drafts in June 2026 to add post-quantum keys to US government PIV smart cards alongside the existing ones. Expect a period of hybrid and dual-stack credentials, not a single switch-over.
What to do before the end of 2026
Build a cryptographic inventory. List where public-key cryptography is used: TLS endpoints, VPNs, PKI and certificate authorities, smart cards, device firmware signing, backups, archives. The EU roadmap recommends recording it in a standard format such as a cryptographic bill of materials (CBOM).
Rank by data lifetime. Anything protecting data that must stay confidential for ten years or more goes first.
Ask suppliers for dates. Put PQC and crypto-agility in procurement now, so equipment bought this year is not stranded in 2030.
Plan the PKI. Certificate hierarchies, card and key lifecycles, and signed-document validity need the longest lead time.
Prefer hybrid. The EU roadmap and France's ANSSI both recommend combining classical and post-quantum algorithms during the transition.
None of this needs a quantum computer to exist. It needs the inventory, which most hospitals do not yet have.
